SuSE 10 Security Update : ncpfs (ZYPP Patch Number 7023)

This update fixes three security issues in ncpfs : Fixed a information leakage on mount CVE-2010-0790 / bnc583536 Fixed a mtab locking problem CVE-2010-0791 / bnc583536 Fixed a race condition in ncpfs mounts. CVE-2010-0788 / bnc550004 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : clamav (ZYPP Patch Number 7056)

This update fixes the following security issues in clamav that can be used as a remote denial of service attack : - An off-by-one buffer overflow. CVE-2010-1640 - A crash while parsing PDFs CVE-2010-1639 / CVE-2010-2077 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of...

SuSE 10 Security Update : Samba (ZYPP Patch Number 6551)

samba's makeconnectionsnum handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed CVE-2009-2948 as well as a DoS condition. CVE-2009-290...

SuSE 10 Security Update : neon (ZYPP Patch Number 6549)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

SuSE 10 Security Update : xntp (ZYPP Patch Number 6718)

By sending specially crafted NTP packets attackers could make ntpd flood it's log file with error messages or even run into an endless loop. CVE-2009-3563 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6944)

This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as CVE-2009-3555. It also fixes a mishandling of OOM conditions in bnwexpand. CVE-2009-3245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenLDAP 2 (ZYPP Patch Number 6598)

This update of openldap2 makes SSL certificate verification more robust against uses of the special character \0 in the subjects name. CVE-2009-2408 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 6652)

Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : iscsitarget (ZYPP Patch Number 7109)

This update of iscscitarget/tgt fixes multiple overflows and a format string vulnerability : - CVE-2010-2221: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Buffer Errors CWE-119 - CVE-2010-0743: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Format String Vulnerability...

SuSE 10 Security Update : libvorbis (ZYPP Patch Number 7057)

This update of libvorbis fixes a memory corruption while parsing OGG files. The bug is exploitable by remote attackers to cause an application crash and could probably be exploited to execute arbitrary code. The issue has been tracked as CVE-2009-2663. %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 7029)

The following bugs have been fixed : evolution considered S/MIME signatures to be valid even for modified mails CVE-2009-0547. specially crafted base64 encoded messages could cause a heap buffer overflow CVE-2009-0587. A POP3 server sending overly long lines could crash evolution. %NASLMINLEVEL...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6890)

This update of ethereal fixes : - Several buffer overflows in the LWRES dissector. CVE-2010-0304 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49846;...

SuSE 10 Security Update : libapr1 (ZYPP Patch Number 6545)

This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. CVE-2009-2412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : sendmail (ZYPP Patch Number 6860)

This update of sendmail improves the handling of special-characters in the SSL certificate. CVE-2009-4565: CVSS v2 Base Score: 7.5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Python (ZYPP Patch Number 6946)

This update of python has a copy of libxmlrpc that is vulnerable to denial of service bugs that can occur while processing malformed XML input. CVE-2009-2625: CVSS v2 Base Score: 5.0 moderate AV:N/AC:L/Au:N/C:N/I:N/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2009-3720: CVSS v2 Ba...

SuSE 10 Security Update : pango (ZYPP Patch Number 6800)

A long glyph string can trigger a heap-based buffer overflow in pango. CVE-2009-1194 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49911; scriptversion"1.11";...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6666)

The Mozilla Firefox 3.5.5 release fixes some instability issues caused by the 3.5.4 security upgrade. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49888;...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 6560)

Specially crafted PDF files could cause buffer overflows in xpdf when viewing such a document. CVE-2009-3603 / CVE-2009-3604 / CVE-2009-3605 / CVE-2009-3606 / CVE-2009-3608 / CVE-2009-3609 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. i...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6655)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 10 Security Update : cron (ZYPP Patch Number 6865)

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry. - CVSS v2 Base Score: 3.6 Additionally the return value of initgroups is verified now. CVE-2010-0424 %NASLMINLEVEL 70300 C Tenable Network Security,...